🤖 Securing our codebase with autonomous agents
Cursor's security team built a fleet of security agents to find and fix vulnerabilities across a fast-changing codebase.
https://cursor.com/blog/security-agents
#AI
Cursor's security team built a fleet of security agents to find and fix vulnerabilities across a fast-changing codebase.
https://cursor.com/blog/security-agents
#AI
👍2❤1🔥1
OpenSandbox is a general-purpose sandbox platform for AI applications, offering multi-language SDKs, unified sandbox APIs, and Docker/Kubernetes runtimes for scenarios like Coding Agents, GUI Agents, Agent Evaluation, AI Code Execution, and RL Training.
https://github.com/alibaba/OpenSandbox
#AI
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
🔶 Cracks in the Bedrock: Bypassing SCP Enforcement with Long-Lived API Keys
Sonrai Security researcher discovered that AWS "bedrock-mantle" IAM permissions could bypass SCP enforcement when using long-lived Service Specific Credential API keys. IAM policy denials worked correctly, but SCP denials were bypassed. AWS patched this between Jan–Feb 2026; no customer action required.
https://sonraisecurity.com/blog/cracks-in-the-bedrock
#aws
Sonrai Security researcher discovered that AWS "bedrock-mantle" IAM permissions could bypass SCP enforcement when using long-lived Service Specific Credential API keys. IAM policy denials worked correctly, but SCP denials were bypassed. AWS patched this between Jan–Feb 2026; no customer action required.
https://sonraisecurity.com/blog/cracks-in-the-bedrock
#aws
❤1👍1🔥1
🔶 Simulating Ransomware with AWS KMS
Post that demonstrates how attackers can abuse AWS KMS by importing malicious key material to encrypt RDS/EBS resources, then deleting the material to make data inaccessible without ransom payment.
https://heilancoos.github.io/research/2025/09/02/aws-kms-ransomware.html
#aws
Post that demonstrates how attackers can abuse AWS KMS by importing malicious key material to encrypt RDS/EBS resources, then deleting the material to make data inaccessible without ransom payment.
https://heilancoos.github.io/research/2025/09/02/aws-kms-ransomware.html
#aws
❤1👍1🔥1
🔶 Locking down AWS principal tags with RCPs and SCPs
A post explaining how to use SCPs to restrict sensitive IAM actions to tagged principals, RCPs to block unauthorized "scp-*" session tags from external/non-tagger principals, and SCPs to protect the "tagger" role itself via CloudFormation StackSets.
https://awsteele.com/blog/2026/02/21/locking-down-aws-principal-tags-with-rcps-and-scps.html
#aws
A post explaining how to use SCPs to restrict sensitive IAM actions to tagged principals, RCPs to block unauthorized "scp-*" session tags from external/non-tagger principals, and SCPs to protect the "tagger" role itself via CloudFormation StackSets.
https://awsteele.com/blog/2026/02/21/locking-down-aws-principal-tags-with-rcps-and-scps.html
#aws
❤1👍1🔥1
🔴 Remote Command Execution in Google Cloud with Single Directory Deletion - GMO Flatt Security Research
A race condition in Google Cloud Looker's directory deletion API allows deleting the ".git" directory while concurrent Git operations proceed, causing Git to use attacker-controlled worktree configs for RCE. Kubernetes service account misconfigurations further enabled cross-instance privilege escalation.
https://flatt.tech/research/posts/remote-command-execution-in-google-cloud-with-single-directory-deletion
#gcp
A race condition in Google Cloud Looker's directory deletion API allows deleting the ".git" directory while concurrent Git operations proceed, causing Git to use attacker-controlled worktree configs for RCE. Kubernetes service account misconfigurations further enabled cross-instance privilege escalation.
https://flatt.tech/research/posts/remote-command-execution-in-google-cloud-with-single-directory-deletion
#gcp
❤1👍1🔥1🤯1
A large-scale phishing campaign is targeting developers directly inside GitHub, using fake Visual Studio Code security alerts posted through Discussions to trick users into installing malicious software.
https://socket.dev/blog/widespread-github-campaign-uses-fake-vs-code-security-alerts-to-deliver-malware
#github
Please open Telegram to view this post
VIEW IN TELEGRAM
❤1👍1🔥1
Railway PaaS is being weaponized as a clean token replay engine in an active AiTM and device code phishing campaign impacting 268+ M365 organizations and 100+ MSPs.
https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign
#PaaS
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
❤2👍1🔥1
🔴 Double Agents: Exposing Security Blind Spots in GCP Vertex AI
Unit 42 researchers found that GCP Vertex AI Agent Engine's default P4SA service account has excessive permissions, enabling credential theft via the metadata service. This allows privilege escalation to read all consumer GCS buckets, access restricted Google-internal Artifact Registry container images, and expose internal source code.
https://unit42.paloaltonetworks.com/double-agents-vertex-ai
#gcp
Unit 42 researchers found that GCP Vertex AI Agent Engine's default P4SA service account has excessive permissions, enabling credential theft via the metadata service. This allows privilege escalation to read all consumer GCS buckets, access restricted Google-internal Artifact Registry container images, and expose internal source code.
https://unit42.paloaltonetworks.com/double-agents-vertex-ai
#gcp
❤1👍1🔥1
🔶 Enforcing AI Governance Across AWS Organizations
Learn how to enforce AI governance across AWS organizations using Bedrock guardrails, MCP server controls, model availability rules, and API restrictions to reduce risk and improve security.
https://sonraisecurity.com/enforcing-ai-governance-across-aws-orgs
#aws
Learn how to enforce AI governance across AWS organizations using Bedrock guardrails, MCP server controls, model availability rules, and API restrictions to reduce risk and improve security.
https://sonraisecurity.com/enforcing-ai-governance-across-aws-orgs
#aws
❤2👍1🔥1
🔶 aws-preflight
Check your AWS CLI commands for security risks before you run them.
https://github.com/gabrielPav/aws-preflight
#aws
Check your AWS CLI commands for security risks before you run them.
https://github.com/gabrielPav/aws-preflight
#aws
❤1👍1🔥1
🔶 AWS Security Agent on-demand penetration testing now generally available
AWS Security Agent on-demand penetration testing is now GA, offering autonomous 24/7 multi-cloud pen testing combining SAST, DAST, and context-aware agentic AI.
https://aws.amazon.com/ru/blogs/security/aws-security-agent-on-demand-penetration-testing-now-generally-available/
#aws
AWS Security Agent on-demand penetration testing is now GA, offering autonomous 24/7 multi-cloud pen testing combining SAST, DAST, and context-aware agentic AI.
https://aws.amazon.com/ru/blogs/security/aws-security-agent-on-demand-penetration-testing-now-generally-available/
#aws
🔥4❤1👍1
🤖 How Command Injection Vulnerability in OpenAI Codex Leads to GitHub Token Compromise
BeyondTrust Phantom Labs recently identified a critical command injection vulnerability in OpenAI Codex that allowed for the theft of GitHub User Access Tokens.
https://www.beyondtrust.com/blog/entry/openai-codex-command-injection-vulnerability-github-token
#AI
BeyondTrust Phantom Labs recently identified a critical command injection vulnerability in OpenAI Codex that allowed for the theft of GitHub User Access Tokens.
https://www.beyondtrust.com/blog/entry/openai-codex-command-injection-vulnerability-github-token
#AI
❤1👍1🔥1
🔶 Unexpected Routing Behaviour in AWS with VPC Peering and NAT Gateway
When routing VPC peering traffic through an internal NAT gateway in AWS, response traffic bypasses route tables via connection tracking, making all subnets in the peered VPC reachable even without return routes configured. AWS confirmed this is "expected behaviour.".
https://labs.reversec.com/posts/2026/03/unexpected-routing-behaviour-in-aws-with-vpc-peering-and-nat-gateway
#aws
When routing VPC peering traffic through an internal NAT gateway in AWS, response traffic bypasses route tables via connection tracking, making all subnets in the peered VPC reachable even without return routes configured. AWS confirmed this is "expected behaviour.".
https://labs.reversec.com/posts/2026/03/unexpected-routing-behaviour-in-aws-with-vpc-peering-and-nat-gateway
#aws
❤1👍1🔥1